Core Threats & Attacks
The most common weapons attackers use — yeh sab basic attacks hain jo real-world mein sabse zyada hote hain.
Malware = Malicious + Software. Koi bhi software jo deliberately tumhare system ko harm karta hai — data churaata hai, corrupt karta hai, ya control leta hai.
Virus, Worm, Trojan, Ransomware, Spyware, Adware, Rootkit, Keylogger — sab malware ke hi forms hain. Agle chapter mein har ek detail mein hai.
Malware ek bimari ki tarah hai. Jaise flu (virus), jaundice (spyware jo slowly damage kare), ya cholera (worm jo paani se spread ho) — sab alag hai, sab nuksan karta hai, par sab "bimari" hi hai.
WannaCry (2017): 150 countries mein ek worm-based malware ne UK ke NHS hospitals, Telefónica Spain, aur FedEx ko paralyze kar diya. $4 billion+ estimated loss. Ek unpatched Windows vulnerability se spread hua.
- Updated antivirus always run karo
- OS aur software patches turant apply karo
- Unknown links/files pe click mat karo
- Regular backups rakho offline
Attacker ek fake email/website/SMS banaata hai jo bilkul legit dikhti hai (bank, Google, Amazon). Tum usmein apni credentials enter karo — aur woh chala jaata hai.
Spear Phishing: Targeted attack (naam se bulata hai)
Whaling: CEOs ko target
Smishing: SMS se
Vishing: Voice call se
Fake Email
Receives
Link
Website
Stolen!
Google & Facebook Scam (2013-2015): Evaldas Rimasauskas ne Lithuania se fake invoices Google aur Facebook ko bheji (impersonating Quanta Computer). $100M+ chura liye. Dono companies ne actually pay kiya!
- Sender ka email address dhyan se check karo
- Links pe hover karo URL dekhne ke liye pehle click se
- Koi bhi urgency feel ho — ruko, verify karo
- 2FA enable karo har jagah
Malware jo tumhare saare files encrypt kar deta hai (lock), phir Bitcoin mein payment maangta hai key ke liye. Pay karo ya data jaata hai.
Phishing emails, malicious attachments, unpatched software, RDP bruteforce. Ek infected machine poore network ko infect kar sakti hai.
- Malware system pe install hota hai (usually phishing se)
- Quietly files dhundhta hai — documents, photos, databases
- Strong encryption (AES-256) se sab files lock kar deta hai
- Screen pe ransom note dikhta hai with Bitcoin address
- Timer shuru hota hai — nahi diya to price badhta hai ya key delete
Colonial Pipeline (2021): US ki sabse badi fuel pipeline band ho gayi jab DarkSide ransomware ne attack kiya. $4.4 million ransom diya gaya. East coast mein fuel shortage aayi, panic buying shuru. Biden ne national emergency declare kiya.
- Offline backups (3-2-1 rule: 3 copies, 2 media, 1 offsite)
- Network segmentation — infection spread na ho
- RDP access restrict karo
- Pay mat karo — koi guarantee nahi key milegi
Hazaron ya laakhon infected computers ka ek network, jise ek "bot herder" (attacker) remotely control karta hai. Tumhara PC bina tumhare jaane bot ban sakta hai.
DDoS attacks, spam sending, crypto mining, credential theft, ad fraud. Attacker yeh bots dark web pe rent pe bhi deta hai doosron ko.
Sochao koi tumhare phone ko secretly remote control kar raha hai. Tum normal use kar rahe ho, but background mein woh kisi par spam bhej raha hai ya kisi website ko attack kar raha hai tumhare naam se.
Mirai Botnet (2016): IoT devices (cameras, routers) ko infect kar ke ek massive botnet banaya gaya. Iska use Dyn DNS pe DDoS attack karne ke liye hua jisse Twitter, Netflix, Amazon, Reddit — sab down ho gaye US mein ek din ke liye.
Hazaron bots ek hi server par ek saath itna traffic bhejte hain ki server handle nahi kar paata aur crash ya freeze ho jaata hai. Real users access nahi kar paate.
DoS: Single machine se attack (easy to block)
DDoS: Distributed = hazaron machines se (almost impossible to block)
C&C Server
Bots
Server
CRASH
GitHub (2018): 1.35 Tbps ka attack — history ka biggest DDoS at that time. Memcached servers ka exploit karke amplification attack tha. GitHub 10 minutes tak down raha phir Akamai ne traffic absorb kiya.
- CDN use karo (Cloudflare, Akamai) jo traffic absorb kare
- Rate limiting implement karo
- Anycast network diffusion
- ISP-level filtering
Attacker do parties ke beech mein secretly ghus jaata hai. Tum sochte ho tum bank se baat kar rahe ho, par actually attacker beech mein hai, data padhta aur modify karta hai.
ARP Spoofing: Local network pe
DNS Spoofing: Wrong IP deta hai
SSL Stripping: HTTPS → HTTP downgrade
Evil Twin: Fake WiFi hotspot
(Victim)
MITM
Bank
Tumne apne dost ko letter bheja. Par postman ne woh letter open kiya, padhा, kuch badla, seal band kiya, aur bheja. Dono kisi ko nahi pata kuch hua bhi hai. Exactly yahi MITM hai.
Public WiFi MITM: Coffee shop/airport ke open WiFi par attacker "Evil Twin" attack karta hai — same naam ka fake hotspot. Tum connect hote ho, woh sab traffic dekh sakta hai.
Web forms mein SQL code enter karke database ko trick kiya jaata hai. Attacker login bypass kar sakta hai, data chura sakta hai, ya database delete kar sakta hai.
Jab website user input ko directly SQL query mein daalti hai bina sanitize kiye, attacker SQL command as input deta hai jo database execute kar leta hai.
Heartland Payment Systems (2008): SQL injection se 130 million credit card numbers chori hue. $140 million+ settlement. At that time, US history ki largest data breach.
- Parameterized queries / prepared statements use karo
- Input validation aur sanitization
- WAF (Web Application Firewall) use karo
- Principle of least privilege for database users
Attacker website mein malicious JavaScript inject karta hai. Jab koi user woh page open kare, unka browser attacker ka script run karta hai — cookies, session tokens chori ho sakte hain.
Stored XSS: Script database mein save (e.g. comments)
Reflected XSS: URL mein script inject
DOM-based: Client-side manipulation
Samy Worm (MySpace, 2005): Samy Kamkar ne MySpace profile pe XSS script daali. Ek din mein 1 million+ profiles ne automatically "Samy is my hero" add kar liya. Ek teen ki prank ne history ka fastest spreading virus banaya.
Tum bank.com mein logged in ho. Attacker tumhe ek evil website pe le jaata hai. Woh website background mein bank.com pe request bhejti hai tumhare naam se — tumhara pata bhi nahi.
Browser automatically cookies bhejta hai same domain ke requests mein. Attacker iska fayda uthata hai — tumhara browser auth karta hai, request jayegi.
Koi tumhara haath pakad ke ek cheque pe sign karwa leta hai jab tum neend mein ho. Tumne kiya nahi, par signature tumhara hai. CSRF exactly aisa — browser tumhara auth use karta hai bina tumhare jaane.
- CSRF tokens — har request mein unique token
- SameSite cookie attribute
- Origin header verify karo server side
"Zero days" because vendor ko zero days mila fix karne ke liye — vulnerability abhi abhi discover hua, patch nahi bana, aur attacker already exploit kar raha hai.
Zero-day exploits dark web pe $1M+ mein bika karte hain. NSA, intelligence agencies bhi buy karti hain. Google ka Project Zero team inka hunt karta hai.
Stuxnet (2010): US+Israel jointly banaya ek zero-day exploit jo Iran ke nuclear centrifuges ko physically damage karne ke liye. 4 zero-days ek saath use kiye — unprecedented. Iran ke Natanz facility mein 1,000 centrifuges destroy huye bina koi bomb use kiye.
Malware Types
Malware ke alag-alag forms — sab damage karte hain, par alag tarike se
Virus ek malicious code hai jo existing files mein attach ho jaata hai. Jab infected file run karo, virus execute hota hai aur doosri files ko infect karna shuru karta hai. Human action required hai spread ke liye (file share karo).
Human help required. Automatic nahi spread hota. Tumhe infected file kisi ko deni padti hai — email, USB, download se. Biological virus jaisa — carrier chahiye.
Biological flu virus jaisa. Apne aap nahi chalta — kisi infected insaan se contact chahiye. Ek infected USB → tumhara PC → tumhara shared drive → colleagues.
ILOVEYOU (2000): Email attachment "LOVE-LETTER-FOR-YOU.txt.vbs" — millions ne open kiya, $10 billion damage, 50 million computers infected in 10 days.
Worm standalone hai — kisi file se attach nahi hota, koi human action nahi chahiye. Network vulnerabilities exploit karke apne aap spread hota hai. Ek infected machine → poora network.
Network bandwidth kha jaata hai, servers overload karta hai. Side payloads bhi carry karta hai — ransomware, keyloggers deliver kar sakta hai automatically.
WannaCry (2017): EternalBlue exploit (NSA ka stolen tool) use karke Windows SMB vulnerability pe attack. No user action needed — bas network connection chahiye tha. 300,000+ computers 150 countries mein.
Legit software ki tarah dikhta hai (game, utility, crack) par andar malicious code hota hai. Tum khud install karte ho. Greek mythology ke Trojan Horse jaise — gift ke andar soldiers.
Banking Trojans (credentials chori), RATs (remote access), Backdoor Trojans (attacker ka entry point), Downloader Trojans (aur malware download karte hain).
Zeus Trojan (2007-2010): Banking credentials chori karta tha. 70,000+ organizations affect, $70 million+ stolen including NASA computers. Ek pirated game ke saath typically aata tha.
OS ke deepest level (kernel) mein install hota hai. Apne aap ko aur doosre malware ko antivirus se hide karta hai. "Root" = highest admin access, "Kit" = tools.
Standard antivirus detect nahi kar paata. OS ke andar se hi system calls intercept karta hai aur fake information return karta hai. Remove karna almost impossible.
Sony BMG CD Rootkit (2005): Sony ne music CDs mein rootkit embed kiya DRM ke liye. 22 million CDs affected. Users ke computers pe bina bataye install ho jaata tha. Massive lawsuit, public outrage.
Background mein quietly tumhare keyboard ke har key press ko record karta hai. Phir log file attacker ko bhejta hai. Tumhara bank password, personal messages, credit card — sab caught.
Software: OS level mein hook
Hardware: Physical device keyboard aur PC ke beech
Browser-based: Form data intercept
- Virtual keyboard use karo banking ke liye
- 2FA se keylogger useless ho jaata hai passwords ke liye
- Physical keyboard ports check karo public computers pe
Background mein chup ke tumhari activities monitor karta hai — browsing history, location, contacts, camera/microphone access, screenshots. Data attacker ko remotely bhejta hai.
Keylogger sirf keystrokes, Spyware broader — screenshots, file access, location, social media, call logs sab.
Pegasus Spyware (NSO Group): iOS aur Android zero-click exploit se install hota tha — tumhe kuch click bhi nahi karna. Journalists, activists, world leaders ke phones compromise. Saudi Arabia ne use kiya journalist Jamal Khashoggi ke network ko monitor karne ke liye.
Automatically ads show karta hai — popups, browser redirects, fake alerts. Revenue generate karta hai advertiser ke liye. Free software ke saath bundled aata hai often.
Mostly annoying, but some adware spyware ka gateway hai. Malvertising (malicious ads) se serious malware download ho sakta hai. Browser settings hijack kar leta hai.
Disk pe koi file nahi likhta. Directly RAM mein run karta hai ya Windows ke legitimate tools (PowerShell, WMI) ko abuse karta hai. Antivirus file scan nahi kar sakta kyunki file hi nahi hai.
Living-off-the-land (LotL) attack. PowerShell, cmd, regedit — Windows ke apne tools use karta hai. Computer restart pe woh gone — par tab tak kaafi damage kar chuka hota hai.
Operation Cobalt Kitty (2017): Vietnamese bank pe APT attack. 6 mahine tak undetected raha kyunki PowerShell aur WMI tools use karta tha. $200M+ theft attempt.
Attacker tumhara poora computer remotely control kar sakta hai — mouse, keyboard, camera, microphone, files, install software. TeamViewer jaisa, but without your knowledge.
Screen dekh sakta hai live, camera on kar sakta hai, files copy/delete, keylog, bank transfers, screenshot, aur tumhare PC ko botnet mein add.
Blackshades RAT (2012-2014): 17-year-old Swedish teen ne banaya, $40 pe dark web pe becha. 700,000 computers compromise. Miss Teen USA ki webcam se photos leak. FBI ne worldwide sting operation chalayi.
SaaS ki tarah, but evil. Ransomware developers apna malware dark web pe "rent" pe dete hain. Koi bhi coding nahi jaanta buy kar sakta hai, attack kar sakta hai. Revenue split hoti hai developer aur attacker ke beech.
70-30 split typically. Developer 30% leta hai ransom ka, attacker 70%. Support bhi milta hai, control panel, ransom negotiation services. Full criminal enterprise.
DarkSide RaaS: Colonial Pipeline attack isi se hua. Professional website thi, customer support, even a "code of ethics" — hospitals attack mat karo. Pure criminal SaaS business.
Defensive Tools & Technologies
Yeh weapons tumhari taraf hain — organizations inhe use karti hain apna bachav karne ke liye
Network traffic monitor karta hai aur predefined rules ke basis pe allow ya block karta hai. Ek border guard ki tarah — passport check karo, phir andar jaane do.
Packet Filtering: IP/port check
Stateful: Connection state track
NGFW: Deep packet inspection, app-aware
WAF: Web apps ke liye specifically
Building ka security guard. Rules hai — employees andar, strangers stop. Firewall bhi aisa — trusted IP allow, unknown ports block. But smart attacker allowed port use karta hai (bypass).
Signature-based: Known malware ke "fingerprints" se match
Heuristic: Suspicious behavior detect karo (new malware ke liye)
Sandboxing: Isolated environment mein run karke dekho
Signature-based antivirus sirf known threats detect karta hai. Zero-day, fileless malware, polymorphic malware (jo apna code change karta hai) se bachna mushkil. Modern AV + behavior analysis zaroori hai.
Network/system traffic monitor karta hai suspicious activity ke liye. Kuch galat dikhta hai to alert bhejta hai security team ko. But khud kuch nahi karta — sirf bolta hai "kuch ho raha hai!"
NIDS: Network-based (poora network traffic dekhe)
HIDS: Host-based (ek specific machine dekhe)
Signature-based: Known attack patterns
Anomaly-based: Normal se deviation detect kare
Smoke detector. Aag lagti hai, alarm bajta hai. But khud aag nahi bujhaata — tumhe call karna padega fire brigade (human response). IDS detect karta hai, IPS block bhi karta hai.
IDS = passive (sirf alert), IPS = active (alert + automatically block karta hai). IPS network path mein inline hota hai — traffic isse hoke jaata hai, woh inspect karta hai, aur block kar sakta hai real-time mein.
False positives ka risk — legitimate traffic bhi block ho sakta hai. Production systems mein carefully configure karna padta hai nahi to business impact hota hai.
Poore organization ke saare security tools se logs collect karta hai ek jagah, correlate karta hai, patterns dhundta hai, aur threats identify karta hai. SOC team ka main tool.
Splunk, IBM QRadar, Microsoft Sentinel, LogRhythm. Large enterprises mein terabytes of daily logs ek dashboard pe analyze hote hain.
CCTV control room of a mall — hazaron cameras ek jagah. Guard sab dekh sakta hai ek monitor pe. Alag-alag cameras dekhen to pattern miss ho jaaye, SIEM central view deta hai.
Normal firewall packets block karta hai, WAF HTTP traffic ko analyze karta hai specifically. SQL injection, XSS, CSRF detect aur block karta hai web layer pe.
Web server aur internet ke beech. Cloudflare, AWS WAF, Imperva popular solutions hain. Har incoming web request ko scan karta hai malicious patterns ke liye.
Har individual device (endpoint) ko secure karna — laptops, phones, tablets, servers. Sirf antivirus nahi — EDR (Endpoint Detection & Response) tools real-time behavior monitor karte hain.
EDR tools (CrowdStrike, SentinelOne) behavior analytics, threat hunting, automated response sab karte hain. Zero-day bhi detect ho sakta hai anomalous behavior se.
Monitor aur control karta hai ki sensitive data (credit cards, SSN, confidential docs) organization se bahar na jaaye — email, USB, cloud uploads ke through.
Content inspection — emails scan karta hai "confidential" patterns ke liye. Block kar deta hai ya alert deta hai. Insider threats ke against especially useful.
Isolated virtual environment jahan suspicious files ya programs run kiye jaate hain safely. Agar malware hai to real system affect nahi hoga — sandbox ke andar hi confined.
Email attachments, unknown executables, browser extensions — pehle sandbox mein run karo, behavior dekho, phir decide karo. Automated malware analysis ke liye use hota hai.
Chemical lab mein hazardous material ke liye glove box. Bahar effects nahi pahunch sakte, andar jaake experiment kar sakte ho safely.
Deliberately vulnerable fake system jo attackers ko lure karta hai. Jab attacker ise target karta hai, security team unke tactics, techniques, tools study kar sakti hai real-time mein.
Early warning system. Attacker iska real system samajh ke attack karta hai, par actually decoy hai. Unke methods log hote hain — future defenses improve hote hain.
Police ka undercover operation ya bait car. Woh deliberately exposed car chodh ke thieves attract karte hain, phir catch karte hain ya unhe study karte hain patterns ke liye.
Encryption & Protocols
Data ko scramble karna taaki sirf sahi log padhein — internet ki neev
Plaintext ko ciphertext mein convert karna using an algorithm aur key. Bina key ke — garbage. Key ke saath — original data. Two types: Symmetric (same key) aur Asymmetric (public/private key pair).
Symmetric: AES — same key encrypt aur decrypt karne ke liye. Fast.
Asymmetric: RSA — public key se encrypt, private key se decrypt. Slower but more secure.
Tumhara diary mein secret language likhna — sirf tumhe pata hai "cat = 7, dog = 9". Key yaad ho to padhlo, nahi to gibberish. Encryption exactly aise, par mathematically unbreakable.
Message sirf sender ke device pe encrypt hota hai aur sirf receiver ke device pe decrypt hota hai. Server bhi nahi padh sakta — even WhatsApp apne messages nahi padh sakta.
WhatsApp (Signal Protocol), Signal, iMessage (when blue), Telegram (Secret Chats only — normal chats E2EE nahi hain!). Regular email E2EE nahi hai.
Encrypts
(Server sees 🔒)
Decrypts
US government approved symmetric encryption algorithm. AES-128, AES-192, AES-256 (key size). AES-256 is unbreakable with today's computers — even supercomputer billions of years lagenge.
Wi-Fi (WPA2), HTTPS, file encryption, banking, WhatsApp messages, disk encryption (BitLocker, FileVault). Tum daily AES use karte ho without knowing.
Public key pairs, digital certificates, Certificate Authorities (CA) ka poora framework. Identity verify karta hai online — kaisa pata chale ki google.com actually Google hai aur fake site nahi?
CA (Certificate Authority): Trusted issuer (DigiCert, Let's Encrypt)
Digital Certificate: Identity proof
CRL: Revoked certificates ki list
Electronic document jo ek entity ki identity prove karta hai aur unki public key contain karta hai. CA (Certificate Authority) issue karta hai. Browser ka padlock icon yahi hai.
Owner name, public key, issuing CA, validity dates, domain name, CA's digital signature (tamper proof).
Passport jaisa. Government (CA) ne issue kiya, tumhara photo aur details hain (public key), expiry date hai, aur tamper-proof features hain. Bank ne passport dekha → trust kiya.
Apni private key se document ko "sign" karna. Koi bhi tumhari public key se verify kar sakta hai ki document tumne hi sign kiya aur modify nahi hua. Non-repudiation provide karta hai.
1. Document ka hash generate karo
2. Private key se hash encrypt karo (= signature)
3. Receiver: same hash generate karo, public key se signature decrypt karo, match karo
Secure communication protocol jo browser aur server ke beech encrypted connection establish karta hai. Ab technically deprecated hai — TLS use hota hai, par "SSL" term abhi bhi common hai.
SSL 2.0 (1995) → SSL 3.0 → TLS 1.0 → TLS 1.1 → TLS 1.2 → TLS 1.3 (current). SSL 3.0 mein POODLE vulnerability thi isliye abandon kiya gaya.
Current secure communication protocol. Jab tum HTTPS use karte ho, actually TLS run ho raha hai. Encryption, authentication, integrity — teeno provide karta hai.
1. Client: "Hello, I support TLS 1.3"
2. Server: "OK, here's my certificate"
3. Key exchange
4. Encrypted communication begins
HTTP (web protocol) + TLS (encryption) = HTTPS. Browser ka padlock icon = HTTPS. Data encrypted hai transit mein — MITM attacker garbled text hi dekhega.
HTTPS = secure site NAHI. Sirf matlab hai connection encrypted hai. Fake phishing sites bhi HTTPS use karti hain. Padlock ≠ trustworthy website.
Remote server ko securely access karna command line se. Web developers, system admins daily use karte hain. Telnet (unencrypted predecessor) ko replace kiya 1995 mein.
Password ke alawa SSH keys use kar sakte ho — more secure. Public key server pe, private key tumhare paas. Brute force practically impossible.
Identity & Access Management
Who are you? Kya tumhe yahan rehne ka haq hai? Yeh sab IAM decide karta hai.
Login ke liye 2 cheezein chahiye: kuch tum jaante ho (password) + kuch tumhare paas hai (phone OTP) ya kuch tum ho (fingerprint). Password chori bhi ho to koi faida nahi attacker ko.
SMS OTP (weakest — SIM swap possible), Authenticator App (better — Google Auth, Authy), Hardware Key (strongest — YubiKey), Biometric.
ATM — PIN (kuch tum jaante ho) + ATM card (kuch tumhare paas hai). Sirf PIN nahi, sirf card nahi — dono chahiye. 2FA yahi concept online.
2023 mein MGM Resorts hack mein — social engineering se employee credentials mili. Agar proper MFA hota to hack fail ho jaata. $100M+ loss directly 2FA missing ki wajah se.
2FA specifically 2 factors. MFA = 2 ya zyada factors. Three categories: Knowledge (password), Possession (phone/token), Inherence (biometric). Mix karo — harder to breach.
🧠 Know: Password, PIN, security question
📱 Have: Phone, security key, smart card
👁️ Are: Fingerprint, face, iris, voice
📍 Where: Location-based (bonus layer)
Framework aur tools jo define karte hain ki kaun user kaun sa resource access kar sakta hai. User accounts banao, permissions assign karo, review karo. Okta, Microsoft Azure AD popular tools.
Least Privilege: Har user sirf woh access mile jo kaam ke liye absolutely zaroori hai — extra nahi. Agar DB admin ko billing system access nahi chahiye, nahi milega.
IAM ka subset jo specifically privileged accounts (admins, root, service accounts) ko protect karta hai. These accounts are highest risk — inka control matlab full system control.
Just-in-time access (sirf jab zaroori), session recording (admin ne kya kiya), password vaulting (auto-rotate passwords), MFA enforcement.
Ek baar login karo (Google ya company account se), sab apps automatically accessible. "Sign in with Google" = SSO. Token exchange hota hai behind the scenes (OAuth, SAML).
SSO account compromise = sab apps compromise. Isliye SSO account pe strong MFA absolutely zaroori. "Single point of failure" bhi ho sakta hai.
Traditional model: network ke andar ho to trusted. Zero Trust: andar ya bahar koi fark nahi — har request verify karo, least privilege do, assume breach. "Trust but verify" → "Never trust, always verify."
Remote work, cloud era mein "corporate network" ka concept gone. Employees anywhere se kaam karte hain. Zero Trust ke bina insider threats aur compromised accounts devastating hote hain.
Google ka BeyondCorp — industry ka pehla large-scale Zero Trust implementation (post-Operation Aurora 2010 China hack). Now industry standard recommendation.
DAC: Owner decide karta hai (files on your PC)
MAC: System decide karta hai (military, classified)
RBAC: Role-based (employees, managers, admins)
ABAC: Attribute-based (time, location, device)
HR role = employee data access. Finance role = payroll access. Developer role = code repo access. Mix nahi hota. Role change karo, permissions automatically change.
Identity verify karna — prove karo tum wahi ho jo tum claim karte ho. Password, biometric, token — sab authentication methods hain.
Authentication = WHO are you? (Passport check)
Authorization = WHAT can you do? (Visa allows entry to certain areas)
Authenticated user ko kya resources access karne ki permission hai. Login ke baad — "can this user read/write/delete this file?" Authorization decide karta hai.
Broken Access Control — OWASP Top 10 mein #1. User A ki ID change karke User B ka data access karna (IDOR). Horizontal aur vertical privilege escalation.
Login ke baad server ek token deta hai (string of characters). Agle requests mein password ki jagah token bhejo. Limited time ke liye valid. JWT (JSON Web Token) most common.
Header.Payload.Signature — 3 parts dot se separated. Payload mein user info (encrypted nahi, base64 encoded!). Signature server verify karta hai.
Movie ticket. Counter pe ID dikhaya (login), ticket mila (token). Ab har movie hall mein token dikhao — baar baar ID nahi dikhani. Ticket expire hoti hai (token expiry).
Network & Cloud Security
Data travel karta hai — usse protect karna aur cloud era ki challenges
Tumhare device aur VPN server ke beech encrypted tunnel. ISP, network admin, hackers — koi nahi dekh sakta tum kya browse kar rahe ho. Tumhara IP bhi VPN server ka IP dikhta hai.
Privacy (ISP se hide), regional content access, public WiFi pe safety, company network remote access. Free VPNs se beware — they sell your data.
Glass tunnel ke through jaana vs opaque armored tube. Normal internet = glass — sab dekh sakte hain. VPN = opaque tube — bahar se kuch nazar nahi.
Ek bada network ko smaller segments mein divide karna (VLANs, subnets). Finance network se developer network alag. Ek zone compromise ho to doosre safe rahein.
Lateral movement prevent karta hai. Attacker ek machine compromise kare par poore network mein freely nahi ghoom sakta. Colonial Pipeline worm bhi segmentation se rok sakte the.
DNS server ki cache mein fake records inject karna. "google.com = 1.2.3.4" — yeh galat IP hai par DNS ye record return karta hai. User google.com type kare, attacker site pe jaaye.
Phone book of internet. "google.com" → "142.250.195.46" translate karta hai. DNS poisoning is phonebook mein galat entries daalna.
Tumhare ghar ke saare devices ek public IP share karte hain (router ka). Router andar private IPs maintain karta hai. Internet se direct access nahi hota internal devices ko — security benefit.
Phone: 192.168.1.5, Laptop: 192.168.1.6 — private IPs. Router: 103.45.67.89 — public IP. Internet pe sirf router ka IP dikhta hai.
Traditional networks mein hardware configure karo manually. SDN mein software se network control hota hai centrally. Security policies dynamically apply ho sakti hain, faster response to threats.
Threat detect hote hi, SDN controller automatically affected segment isolate kar sakta hai. Micro-segmentation easily implement. Cloud networks aise hi work karte hain.
Employees cloud apps (Google Drive, Dropbox, Salesforce) use karte hain. CASB monitor karta hai kya data cloud pe ja raha hai, unauthorized apps ka use ("shadow IT") detect karta hai.
Employee ne confidential doc Dropbox personal pe upload kiya. CASB detect karta hai — alert ya block. DLP + cloud = CASB.
Smart devices jo internet se connected hain — smart bulbs, cameras, fridges, thermostats, wearables, industrial sensors, medical devices. Billions of devices globally.
2030 tak 75 billion+ IoT devices expected. Har device ek potential entry point. Most IoT devices have terrible security — no updates, weak passwords, old firmware.
Limited processing power (can't run complex security), no screen/keyboard for setup, vendors update nahi karte, users default passwords change nahi karte, long lifecycle (10-20 years).
Default passwords change karo, separate network/VLAN pe rakho IoT devices, firmware update karo, unnecessary features disable karo, network monitoring rakho.
Hospital hack via Fish Tank (2017): Casino ka smart fish tank thermometer hack hua. Attackers ne isse network access liya aur casino's high-roller database exfiltrate ki — 10GB data.
Policies, tools, aur practices jo network infrastructure protect karte hain — unauthorized access, misuse, modification, denial prevent karna. Firewall, IDS/IPS, VPN, segmentation sab iske components.
Defense in depth — ek layer breach ho to doosri catch kare. Firewall → IDS → WAF → Endpoint → SIEM — layered approach best practice hai.
Nation-State: Government-backed (Russia APT28, China APT40)
Cybercriminals: Financial motivation
Hacktivists: Political (Anonymous)
Insider Threat: Employees
Script Kiddies: Amateurs
Threat actor type se pata chalta hai motivation kya hai, resources kitne hain, aur defenses kaise adjust karein. Nation-state actors ka zero-day budget ≠ script kiddie ka free tools.
Advanced Threats & Social Engineering
Sophisticated attacks jo months tak undetected reh sakte hain — human psychology exploit karna
Long-term targeted attack — attacker mahino ya saalo tak network mein chupa rehta hai bina detect hue. Nation-states typically. Goal: data exfiltration ya sabotage — not ransomware quick hit.
Advanced: Zero-days, custom malware, multiple vectors
Persistent: Months/years long campaign
Threat: Specific high-value target
SolarWinds (2020): Russia's SVR ne SolarWinds software update mein malware inject kiya (supply chain). 18,000 organizations ne infected update install kiya. US government agencies breach — 9 months undetected.
Government ya corporations ke sensitive information chori karna digital means se. Military plans, technology secrets, diplomatic cables, trade secrets — sab target. Traditional spy agencies ka cyber equivalent.
China (APT40, APT10), Russia (APT28 Fancy Bear, APT29 Cozy Bear), North Korea (Lazarus Group), Iran. India bhi increasingly targeted.
State-sponsored cyberattacks dusre nations ko disrupt ya damage karne ke liye. Power grids, water systems, financial systems, military systems target hote hain. 5th domain of warfare — land, sea, air, space, cyber.
Ukraine power grid attacks by Russia (2015, 2016). Estonia DDoS (2007). Stuxnet vs Iran. NotPetya Ukraine attack ($10B+ global damage). These are acts of war.
Direct target attack mushkil hai. To attacker uske software supplier, hardware vendor, ya IT provider ko compromise karta hai. Target khud infected software install kar leta hai thinking it's legitimate.
Trusted source se aata hai — security bypasses. Scale: ek vendor compromise = hazaron customers compromise simultaneously. Defense very difficult.
SolarWinds Orion (2020) + XZ Utils (2024): Open source library mein backdoor inject kiya gaya 2 years ke patient social engineering ke baad. Nearly compromised OpenSSH on millions of Linux servers.
Systematically har possible password/key combination try karna jab tak sahi na mile. Simple 4-digit PIN = 10,000 combinations. "abc123" jaise common passwords seconds mein crack.
Simple Brute Force: aaa, aab, aac...
Dictionary Attack: Common words list
Rainbow Table: Pre-computed hash lookups
Hybrid: Dictionary + variations
- Rate limiting — 3 attempts failed → lockout
- CAPTCHA
- Long, complex passwords — "Tr0ub4dor&3" better than "password123"
- MFA — even if password cracked, need 2nd factor
Data breach se leaked username-password pairs ko automated tools se hazaron other sites pe try karna. Same password everywhere use karte ho? Ek site breach = sab sites compromise.
Billions of credentials dark web pe available. Tools like Snipr, STORM automate yeh process. 0.1% success rate bhi millions of accounts = huge impact.
- Unique password har site pe — password manager use karo (Bitwarden, 1Password)
- haveibeenpwned.com pe check karo tumhara email leaked hai kya
- MFA always
Malicious: Deliberately data steal ya damage kare (disgruntled employee)
Negligent: Accidentally security mistake kare (click phishing, lose laptop)
Compromised: External attacker ne account highjack kiya
UEBA (behavior analytics) — normal se deviation. Unusual access times, large data downloads, off-hours logins. DLP tools unusual data movement flag karte hain.
Edward Snowden (2013): NSA contractor — 1.7 million classified documents copied aur media ko diye. Sab access legitimate tha — audit trail nahi tha ki woh itna sab ek saath download kar raha hai.
Unskilled individuals jo publicly available tools/scripts use karte hain attacks ke liye bina understanding ke. "Point and click" hacking. Real hackers inhe seriously nahi lete, par inka sheer volume ek threat hai.
Volume mein dangerous — hazaron script kiddies = significant DDoS. Basic vulnerabilities exploit kar lete hain. Patched systems ka importance inhi se pata chalta hai.
Systems jahan digital aur physical world meet karte hain — industrial control systems (ICS), SCADA, power plants, water treatment, hospital equipment. Hack karo → physical world mein damage.
Power grid hack → lights off city mein. Water treatment hack → poison in water. Hospital device hack → patient harm. These are life-and-death scenarios — not just data theft.
Governance & Compliance
Rules, regulations, aur processes — security ko systematic banana
Risk = Threat × Vulnerability × Impact. Identify karo kya risks hain, kitni probability hai, agar hua to kitna damage — phir decide karo accept karo, mitigate karo, transfer karo (insurance) ya avoid karo.
Risk Assessment → Treatment → Monitoring → Repeat. Business decision — har risk ko eliminate karna practically/financially impossible. Acceptable risk level define karo.
GDPR: EU data privacy (fines up to 4% revenue)
PCI-DSS: Credit card data
HIPAA: US healthcare data
ISO 27001: Information security management
SOC 2: Cloud services
Critical distinction! Compliant system can still be insecure. Compliance is minimum bar. Real security goes beyond checkboxes. Many breached companies were "compliant."
Ransomware payment, data breach notification costs, legal fees, business interruption, regulatory fines, PR/crisis management. Premium increasingly expensive — ransomware surge se.
Insurers ab MFA, EDR, backups mandatory require karte hain policy ke liye. Poor security = no insurance ya very high premium.
Vulnerability: Weakness (unpatched software, misconfiguration)
Threat: Potential for harm (attacker wanting to exploit)
Exploit: Actual code/method to use the vulnerability
CVE: Common Vulnerabilities & Exposures — public database
0-10 severity rating. 9.0+ = Critical. CVE-2021-44228 (Log4Shell) = 10/10 — literally maximum severity. Patching priority = CVSS score.
Company authorize karta hai security professionals ko attack karne ke liye — vulnerabilities find karo before real attackers do. Ethical hackers = white hat hackers.
Black Box: No prior info (realistic)
White Box: Full access/info given
Grey Box: Partial info
Red Team: Extended adversary simulation
Bank apne security expert ko bolti hai "try to rob us" — legally. Expert koshish karta hai, gaps dhundhta hai, report karta hai. Fix hote hain before real robber try kare.
Prevention = attack hone mat do. Resilience = attack hone ke baad bhi business continue karo, jaldi recover karo. Modern philosophy: "assume breach" — it WILL happen, be ready.
Incident Response plan, backups, disaster recovery, business continuity plan, crisis communication, lessons learned. RTO (Recovery Time Objective) aur RPO define karo.
Threat actors, their tactics, techniques, procedures (TTPs), indicators of compromise (IoCs) ke baare mein collected aur analyzed information. Proactive defense ke liye use hota hai.
Strategic (board level — risk decisions), Operational (security team — active campaigns), Tactical (analysts — specific TTPs), Technical (SOC — IPs, hashes, domains).
Financial fraud, identity theft, ransomware, hacking, child exploitation, intellectual property theft, dark web drug markets, cyber stalking. $8 trillion+ global annual cost (2023).
IT Act 2000 (amended 2008) covers cyber crimes in India. Cyber cells in major cities. Incidents report karo: cybercrime.gov.in. Section 66 = unauthorized access, Section 67 = obscene content.
Digital platforms pe harassment, threatening, humiliation. Social media, gaming, messaging apps. Doxxing (private info public karna), revenge porn, trolling, fake profiles.
Serious mental health consequences. India mein IT Act aur state laws cover this. Screenshots rakho evidence ke liye, platform report karo, cyber cell complaint karo.
Incident ke baad digital evidence collect, preserve, analyze, aur present karna — court mein use hone ke liye. Disk images, memory dumps, network logs, deleted file recovery.
Evidence integrity — original tamper nahi hona chahiye. Write blockers use karo, hashes verify karo, chain of custody maintain karo. Tampered evidence court mein inadmissible.
Operations & Response
Day-to-day security operations — jab attack hota hai, kya karte hain
1. Preparation: Plan banaao pehle
2. Detection & Analysis: Incident identify karo
3. Containment: Spread rokko
4. Eradication: Root cause remove karo
5. Recovery: Normal operations restore
6. Lessons Learned: Post-mortem
IR Team = CSIRT (Computer Security Incident Response Team). SOC analysts detect karte hain, IR team respond karta hai, executives communicate karte hain. Playbooks pre-defined hote hain.
Dedicated team aur facility jo 24/7/365 organization ki security monitor karti hai. SIEM se alerts aate hain, analysts investigate karte hain, incidents respond karte hain. Tier 1-2-3 analysts.
SOC Analyst — cybersecurity mein most common entry point. Tier 1: alert triage. Tier 2: investigation. Tier 3: threat hunting, advanced analysis. Well paid career path.
Regular security practices jo risk significantly reduce karte hain — just like physical hygiene. 80% of attacks patching aur basic hygiene se prevent ho sakte the.
✅ Strong unique passwords + manager
✅ MFA everywhere
✅ Software updates promptly
✅ Regular backups
✅ Phishing awareness
✅ Least privilege
✅ Encrypt sensitive data
Documentation jo track karta hai evidence kahan hai, kisne handle kiya, kab, aur kaise. Criminal cases mein agar chain break ho to evidence inadmissible ho sakta hai court mein.
Disk image lena → hash verify → sealed storage → transport log → analysis. Har step documented. Original kabhi touch nahi — sirf forensic copy pe kaam karo.
Organization ke saare devices (laptops, phones, tablets) ek platform se manage karna — policies enforce karo, software deploy karo, remote wipe karo agar device lost ho.
BYOD (Bring Your Own Device) era mein employees apne phones pe corporate email use karte hain. UEM security policies enforce karta hai without fully controlling personal devices.
3 copies of data
2 different storage media types
1 offsite/offline copy
Offline backup = ransomware encrypt nahi kar sakta. Cloud backup alag account mein — not same credentials.
Backup hai par restore nahi kiya kabhi? Useless. Regular restore tests mandatory. Many organizations discover backup broken hai tab jab actual disaster ho.
Encryption keys ka lifecycle manage karna — generation, distribution, storage, rotation, destruction. Keys data ke saath same jagah store nahi karni (sabse common mistake).
Hardware Security Module — dedicated hardware jo keys physically protect karta hai. Banks, governments use karte hain. Keys kabhi HSM se bahar nahi jaate.
AWS/Azure/GCP → cloud infrastructure secure karte hain. Customer → data, access, application, configuration secure karna customer ki responsibility. Misconfigured S3 bucket = customer ka fault.
Public S3 buckets, weak IAM roles, no encryption at rest, default security groups allowing all traffic, exposed credentials in code repositories (GitHub).
Capital One (2019): Misconfigured AWS WAF se 100 million credit applications exposed. $190M settlement. Ex-Amazon employee ne exploit kiya. Misconfiguration, not AWS's fault.
SPF: Authorized mail servers list
DKIM: Email digital signature
DMARC: Policy for SPF/DKIM failures
Secure Email Gateway: Spam/malware filter
Sandboxing: Attachments isolate karo
91% of cyberattacks start from phishing email. Email sabse exploited vector hai. SPF+DKIM+DMARC configure karo apne domain pe — email spoofing prevent karta hai.
Best firewall bhi useless hai agar attacker physically server room mein ghus jaaye. Lock pick, RFID clone, tailgating — physical attacks real hain. Server rooms biometric access chahiye.
Keycards, biometrics, CCTV, guards, mantrap (double door airlock), cable locks on laptops, screen locks, clean desk policy, no USB drives policy, visitor logs.
Emerging & Essential Concepts
Future of cybersecurity — AI, dark web, aur jo aage aane wala hai
Deepfake phishing (voice/video clone), AI-generated perfect spear phishing emails, automated vulnerability discovery, adversarial attacks on ML models, AI-generated malware.
Anomaly detection, automated threat response, behavior analytics (UEBA), log analysis at scale, vulnerability prediction, smart SIEM. Both sides use AI — arms race.
WormGPT (2023): ChatGPT jaise AI model, sans restrictions — phishing emails, malware code generate karta tha. Dark web pe subscribe kiya ja sakta tha. Ethics training ke bina AI = powerful criminal tool.
Linux/Unix mein "root" = superuser = god mode. Windows mein "Administrator". Full unrestricted access — files delete, users create, services install, anything. Attackers always try to escalate to root.
Low-level user access se root access tak jaana. Vertical privilege escalation (user → admin) or horizontal (user A → user B's data). Critical vulnerability class.
Proper systems passwords plain text nahi store karte — hash store karte hain. SHA256("password123") = fixed string. Attacker hash file chura ke offline crack karta hai.
Hashcat, John the Ripper — GPU-accelerated password cracking. RTX 4090 = 300 billion MD5 hashes/second. "password" = cracked instantly. "Tr0ub4dor&3" = years.
- bcrypt, Argon2, scrypt — slow hashing algorithms specifically designed for passwords
- Salt (random string add karo before hashing) — rainbow tables defeat karo
- Never use MD5 or SHA1 for passwords
DoS: Single machine se attack. Easy to block (IP ban karo). Limited bandwidth/impact.
DDoS: Distributed — thousands of sources. Can't block all IPs. Chapter 1 mein covered.
Volumetric (flood karo), Protocol (TCP SYN flood — half-open connections exhaust karo), Application layer (HTTP requests — web server crash). Each needs different defense.
Machine learning se user aur entity ka normal behavior baseline karo, phir deviations flag karo. John usually 9-5 India se login karta hai. Suddenly 3am Russia se login = red flag.
Insider threats, compromised accounts, data exfiltration, privilege abuse. Signature se nahi — behavior se detect karta hai. Zero-day threats bhi pakad sakta hai unusual behavior se.
Surface Web: Google index karta hai (4%)
Deep Web: Password-protected, not indexed — email, banking (90%)
Dark Web: Tor needed, anonymous, not indexed (6%)
Dark web = journalist whistleblowers (Tor Project made by US Navy), censorship bypass (Iran, China activists), privacy enthusiasts. But also: drugs, stolen credentials, hitmen (mostly scams), hacking services, child abuse material (ICAC investigates).
Ocean ki tarah. Surface = visible waala hissa. Deep = underwater (banks, gov databases — not evil, just inaccessible without access). Dark = Mariana Trench — reach karna mushkil, kuch genuinely dangerous creatures wahan.
Cyber attack jiske physical consequences hain. Power grids off karna, traffic lights hack, pacemaker attack, autonomous vehicle hijack, water poison — digital command = physical disaster.
Smart cities, connected infrastructure, Industry 4.0 — jitna zyada connectivity, utna zyada attack surface. OT (Operational Technology) security critical ho gayi hai.
Florida Water Treatment (2021): Hacker ne Oldsmar city ke water treatment plant ka SCADA system access kiya aur sodium hydroxide 111x badha diya — drinking water poison attempt. Operator ne catch kiya, disaster averted.
Cloud provider ke resources (S3, EC2, databases) tak access control. Roles, policies, permissions — kaunsa service kaunsa resource access kar sakta hai. Misconfigured Cloud IAM = most common cloud breach cause.
Least privilege — root account daily use mat karo. MFA on root. Roles use karo instead of long-lived access keys. Regular access review. CloudTrail logging enable karo.
Sensitive, confidential ya protected information unauthorized parties ke hands mein jaana. Intentional (hack) ya accidental (misconfigured database). Average cost: $4.45 million (IBM 2023).
GDPR notification 72 hours mein required. Stock price drop (avg 7.5%). Customer trust loss. Class action lawsuits. Regulatory fines. Executives fired. haveibeenpwned.com track karta hai breaches.
Aadhaar (2018): Report aaya ki 1.1 billion Indians ka Aadhaar data accessible tha for ₹500 via WhatsApp. UIDAI ne deny kiya, par investigation ne serious vulnerabilities found. Government data breach consequences are population-scale.
Most widely used. 5 functions:
1. Identify: Assets, risks samjho
2. Protect: Safeguards implement karo
3. Detect: Incidents identify karo
4. Respond: Action lo
5. Recover: Restore karo
ISO 27001: International standard
MITRE ATT&CK: Adversary tactics matrix — actual attack techniques documented
CIS Controls: Top 18 security actions
OWASP Top 10: Web vulnerabilities
Building code for architecture. Alag-alag engineers alag-alag sochein to inconsistency. Framework ek common language aur standard approach deta hai — security "building code."
Humans ko manipulate karke confidential info reveal karwana ya actions perform karwana. Technical skills ki zaroorat nahi — psychological manipulation. Phishing, pretexting, baiting, quid pro quo sab forms.
Pretexting: Fake identity banao (IT support, bank)
Baiting: Infected USB chhodna parking mein
Quid Pro Quo: "IT help ke badle password do"
Tailgating: Physically follow someone through secure door
"Tumhara PC virus infected hai, main IT se hun, abhi remote access do" — yahi social engineering. Firewall bypass nahi kiya, tumhe manipulate kiya khud access dene ke liye.